Which versions of OpenClaw are affected by CVE-2026-53819?

OpenClaw before version 2026.5.27 contains an arbitrary code execution vulnerability allowing attackers to achieve full system compromise through malicious skill installations.. A patch is available.

How to fix or mitigate CVE-2026-53819?

Within 24 hours: Catalog all OpenClaw deployments and document current versions across the organization. Within 7 days: Upgrade all instances to OpenClaw 2026.5.27 or later, prioritizing systems involved in critical operations. Within 30 days: Conduct security audit of skill installation logs and assess systems for compromise indicators, particularly skills from untrusted sources.

OpenClaw CVE-2026-53819

Q: What is the CVSS score of CVE-2026-53819?

CVE-2026-53819 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-36325 HIGH

Untrusted Search Path (CWE-426)

2026-06-11 VulnCheck

GHSA-8wg3-5mcm-fjq8

RCE Openclaw

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Malicious skill delivered remotely (AV:N) executes only after an operator imports and installs it (UI:R); no OpenClaw authentication is required (PR:N) and resulting code execution yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 11, 2026 - 21:22 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 npm packages depend on openclaw (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.5.27.

DescriptionCVE.org

OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute unintended Homebrew-compatible executables during skill setup to compromise the system.

AnalysisAI

Arbitrary code execution in OpenClaw before 2026.5.27 lets attackers hijack the Homebrew executable resolved during skill installation by planting a workspace-level .env file that overrides the trusted Homebrew path. The flaw, classified as CWE-426 (Untrusted Search Path), enables full system compromise when an operator installs a tampered skill. There is no public exploit identified at time of analysis, and the issue is not on the CISA KEV list.

Technical ContextAI

OpenClaw is the affected product per CPE cpe:2.3:a:openclaw:openclaw, and the vulnerability sits in its skill-install pipeline, which shells out to Homebrew to fetch dependencies. CWE-426 (Untrusted Search Path) is the root-cause class: the installer consults a workspace .env file to choose which brew binary to invoke, so any attacker-controlled value in that file decides which executable runs with the operator's privileges. Because .env files are normally treated as project-scoped configuration rather than security-sensitive input, this gives a malicious or compromised skill bundle a reliable way to redirect execution to an attacker-supplied Homebrew-compatible binary.

RemediationAI

Vendor-released patch: upgrade OpenClaw to 2026.5.27 or later as described in GHSA-8wg3-5mcm-fjq8 (https://github.com/openclaw/openclaw/security/advisories/GHSA-8wg3-5mcm-fjq8). Until the upgrade is rolled out, only install skills from sources you fully trust, audit any workspace .env files for entries that point Homebrew (or PATH-related variables) at unexpected binaries, and treat operator workspaces as security boundaries by restricting write access to vetted users; the trade-off is that legitimate workflows relying on per-workspace environment overrides will need to be re-validated. Reference the VulnCheck advisory (https://www.vulncheck.com/advisories/openclaw-arbitrary-homebrew-executable-execution-via-workspace-env-override) for additional indicators.